A classification model construction method and a classification system for domain name classification

Abstract

The application provides a classification model construction method for domain name classification, the classification model is a random forest model, and the random forest model comprises a plurality of decision tree classifiers, the method comprises the following steps: S1, obtaining DNS response data from a DNS server and preprocessing the DNS response data to obtain a training set with domain name type labels, wherein the domain name type label is a one-time domain name label or a non-one-time domain name label; S2, performing a plurality of feature extractions on the training set obtained in step S1 to obtain a feature set corresponding to each domain name sample in the training set; and S3, constructing a random forest model based on the training set after the feature extraction in step S2, wherein the feature set corresponding to the domain name sample is taken as input, and the domain name sample type is taken as output. The random forest model composed of a plurality of decision tree classifiers is used for domain name classification, so as to alleviate the problems of long prediction time and low detection efficiency in the prior art.

Description

Technical Field

[0001] This invention relates to the field of computer technology, specifically to domain name classification technology in the field of computer technology, and more specifically, to a classification model construction method and classification system for domain name classification. Background Technology

[0002] DNS (Domain Name System) server caching provides efficient access to data or resources, enhances DNS scalability and availability, thereby reducing traffic generated in the DNS hierarchy and accelerating user query speeds. In recent years, an increasing number of new internet services have begun to utilize DNS for greater flexibility and scalability. For example, distributed services such as cloud storage, social networks, and metaverses use generated domain names for information distribution and transmission. These generated domain names include a large number of one-time domain names. These one-time domain names, originating from normal activity, typically have normal DNS response results and are indiscriminately cached by DNS servers. However, based on the access characteristics of one-time domain names, it is known that they are rarely queried again during the caching period. If DNS servers indiscriminately cache the DNS response results of one-time domain names, it will result in a large amount of invalid cache space being occupied. Furthermore, because the continuous generation of one-time domain names accelerates the replacement speed of hot domain names, hot domain names will be evicted from the DNS server's cache space earlier than before, leading to a large number of misses and significantly impacting the existing DNS server caching efficiency, thus slowing down user query speeds.

[0003] To address the aforementioned issues, researchers have proposed classic cache replacement methods, including First-In-First-Out (FIFO) and Least Recently Used (LRU). These methods typically employ fixed memory allocation to manage cache usage and improve caching efficiency. However, the implementation logic of classic cache replacement methods is too simplistic and cannot effectively mitigate the negative impact of one-time domain names on DNS server caching. Therefore, researchers have proposed a domain name classification-based cache replacement method. This method identifies and classifies domain names, discarding one-time domain names and caching non-one-time domain names on the DNS server. This aims to alleviate the negative impact of one-time domain names on the DNS server, improve the DNS server cache hit rate, and optimize domain name resolution speed.

[0004] Existing domain name classification-based cache replacement methods primarily use domain name characteristics or neural network models to identify and classify domain names. However, these methods have been shown to suffer from numerous false positives and poor real-time performance. For example, the Pseudo-LRU cache replacement method uses decision trees based on domain name characteristics and training data to classify domain names and caches non-disposable domain names based on the classification results. Since decision trees require no additional empirical knowledge and their name characteristics are simple and interpretable, domain name classification is fast. However, the Pseudo-LRU method uses relatively few name characteristics of disposable domain names for classification, and many non-disposable domain names also have similar name characteristics, easily leading to false positives. False positives can have a greater negative impact on DNS server caching. Another example is DC... 3 The cache replacement method is based on the Long Short-Term Memory (LSTM) neural network model to classify and identify domain names for cache replacement. The LSTM model is not affected by manual feature selection when classifying and identifying domain names. It can effectively extract features automatically, learn and memorize long input sequences, and has high detection accuracy and good recognition effect. However, the LSTM model has high requirements for server computing performance and memory, long prediction time, low detection efficiency, cannot adapt to the environment of high-speed DNS requests, and has poor real-time performance.

[0005] In summary, while existing domain name classification methods used in cache replacement schemes can identify one-time and non-one-time domain names, each method has its own problems. For example, using decision trees to identify one-time domain names relies on fewer name features, and many non-one-time domain names also share similar features, making misclassification easy. Misclassified domain names can have a greater negative impact on DNS server caching. When using neural network models to classify domain names, these models have high requirements for server computing power and memory, resulting in long prediction times, low detection efficiency, and poor real-time performance, making them unsuitable for environments with high-speed DNS requests. Summary of the Invention

[0006] Therefore, the purpose of this invention is to overcome the shortcomings of the prior art and provide a classification model construction method for domain name classification, a classification system for domain name classification, and a domain name processing method applied to a DNS server.

[0007] The objective of this invention is achieved through the following technical solution:

[0008] According to a first aspect of the present invention, a method for constructing a classification model for domain name classification is provided. The classification model is a random forest model, and the random forest model includes multiple decision tree classifiers. The method includes the following steps: S1, obtaining DNS response data from a DNS server and preprocessing it to obtain a training set with domain name type labels, wherein the domain name type labels are one-time domain name labels or non-one-time domain name labels; S2, performing multiple feature extractions on the training set obtained in step S1 to obtain a feature set corresponding to each domain name sample in the training set, wherein the feature set includes features corresponding to multiple features. The value, the multiple features include the first feature, the second feature, the third feature, the fourth feature, the fifth feature, the sixth feature and / or the seventh feature, wherein the first feature is the domain name string length; the second feature is the length of the longest subdomain of the domain name; the third feature is the domain name format field sum; the fourth feature is the number of special length fields of the domain name; the fifth feature is the Shannon entropy of the leftmost segment of the domain name; the sixth feature is the proportion of numbers in the leftmost segment of the domain name; the seventh feature is the ratio of the number of meaningful words in the leftmost segment of the domain name; S3, based on the training set after feature extraction in step S2, a random forest model is constructed with the feature set corresponding to the domain name sample as input and the domain name sample type as output.

[0009] In some embodiments of the present invention, in step S1, DNS response data within a preset time period is obtained from the DNS server, and preprocessed according to the following steps to obtain a training set with domain name type labels: S11, extracting DNS response data with query type A record and AAAA record from the DNS response data; S12, extracting DNS response data with status code indicating no error from the DNS response data obtained after step S11, and randomly selecting multiple domain names of DNS requests as samples to form an initial training set; S13, labeling the domain name samples in the initial training set obtained in step S12 with domain name type labels to obtain a training set with domain name type labels.

[0010] In some embodiments of the present invention, step S13 includes: S131, dividing the initial training set obtained in step S12 into multiple one-time regions according to preset rules; S132, labeling the domain name samples in the initial training set that belong to any of the one-time regions with one-time domain name tags, and labeling the remaining domain name samples that do not belong to any one-time region with non-one-time domain name tags.

[0011] In some embodiments of the present invention, in step S131, the preset rule is as follows: the domain name samples in the initial training set are divided into different regions based on the second-level domain name as the standard, wherein one region corresponds to one second-level domain name, and the domain names in one region all include the second-level domain name corresponding to that region; based on the threshold conditions corresponding to the one-time region identification feature, it is determined whether the second-level domain name corresponding to each region is a one-time region identifier, and the second-level domain name that satisfies all the threshold conditions corresponding to the one-time region identification feature is a one-time region identifier, and the region whose corresponding second-level domain name is a one-time region identifier is regarded as a one-time region.

[0012] In some embodiments of the present invention, the one-time region identification feature includes a first identification feature, a second identification feature, a third identification feature, a fourth identification feature, a fifth identification feature, and a sixth identification feature, wherein the first identification feature is the number of subdomains contained in the region; the second identification feature is the percentage of subdomains in the region with a cache hit rate of 0; the third identification feature is the percentage of subdomains in the region with a probability of being accessed again within their lifetime of 0; the fourth identification feature is the percentage of subdomains in the region with fewer than 5 accesses; the fifth identification feature is the average Shannon entropy of the leftmost segment of all subdomain strings contained in the region; and the sixth identification feature is the variance of the Shannon entropy of the leftmost segment of all subdomain strings contained in the region.

[0013] In some embodiments of the present invention, the threshold condition corresponding to the first identification feature is that the first identification feature value is greater than or equal to 20, the threshold condition corresponding to the second identification feature is that the second identification feature value is greater than or equal to 50%, the threshold condition corresponding to the third identification feature is that the third identification feature value is greater than or equal to 60%, the threshold condition corresponding to the fourth identification feature is that the fourth identification feature value is greater than or equal to 50%, the threshold condition corresponding to the fifth identification feature is that the fifth identification feature value is greater than or equal to 3, and the threshold condition corresponding to the sixth identification feature is that the sixth identification feature value is less than or equal to 1.

[0014] In some embodiments of the present invention, in step S3, when constructing the random forest model, it is necessary to set the weight values ​​corresponding to the various features, wherein the weight value corresponding to each feature is determined experimentally.

[0015] Preferably, the random forest model includes 5 decision tree classifiers, and the depth of the decision tree classifiers is 5.

[0016] According to a second aspect of the present invention, a classification system for domain name classification is provided, the system comprising: a data acquisition module for acquiring data to be processed; a feature extraction module for extracting features from the data to be processed obtained by the data acquisition module to obtain a corresponding feature set; and a classification model constructed by the method of the first aspect for classifying the data to be processed based on the feature set obtained by the feature extraction module.

[0017] According to a third aspect of the present invention, a domain name processing method applied to a DNS server is provided, the method comprising the following steps: T1, obtaining domain name data to be processed; T2, classifying the domain name data to be processed obtained in step T1 using the classification system described in the second aspect to obtain classification results; T3, based on the classification results obtained in step T2, discarding the domain name data to be processed whose classification result is a one-time domain name, and storing the domain name data to be processed whose classification result is a non-one-time domain name in the cache space of the DNS server.

[0018] Compared with existing technologies, the advantages of this invention are as follows: Seven features are selected to distinguish between one-time domain names and non-one-time domain names, which can alleviate the problem in existing methods that cannot distinguish between one-time domain names and non-one-time domain names due to the limited number of name features used, making domain name classification based on domain name features more accurate and reducing misjudgments; a random forest model composed of multiple decision tree classifiers is used for domain name classification to alleviate the problems of long prediction time and low detection efficiency in existing methods. Furthermore, it can effectively improve the hit rate of DNS server cache, thereby accelerating the user's query speed. Attached Figure Description

[0019] The embodiments of the present invention will be further described below with reference to the accompanying drawings, wherein:

[0020] Figure 1 This is a flowchart illustrating a classification model construction method according to an embodiment of the present invention;

[0021] Figure 2 This is a schematic diagram of the first feature evaluation according to an embodiment of the present invention;

[0022] Figure 3 This is a schematic diagram of the second feature evaluation according to an embodiment of the present invention;

[0023] Figure 4 This is a schematic diagram of the third feature evaluation according to an embodiment of the present invention;

[0024] Figure 5 This is a schematic diagram of the fourth feature evaluation according to an embodiment of the present invention;

[0025] Figure 6 This is a schematic diagram of the fifth feature evaluation according to an embodiment of the present invention;

[0026] Figure 7 This is a schematic diagram illustrating the evaluation of the sixth feature according to an embodiment of the present invention;

[0027] Figure 8 This is a schematic diagram of the seventh feature evaluation according to an embodiment of the present invention;

[0028] Figure 9 This is a schematic diagram illustrating an example of feature weights according to an embodiment of the present invention;

[0029] Figure 10 This is a schematic diagram of a classification system according to an embodiment of the present invention. Detailed Implementation

[0030] To make the objectives, technical solutions, and advantages of this invention clearer, the invention is further described in detail below through specific embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0031] As mentioned in the background section, while existing caching replacement schemes employ domain name classification methods that can identify one-time and non-one-time domain names, each scheme has its own problems. In particular, when using decision trees to identify one-time domain names, the number of name features used is limited, and many non-one-time domain names also have similar name features, which can easily lead to misjudgments. Misjudged domain names can have a greater negative impact on DNS server caching. When using neural network models to classify domain names, the neural network models have high requirements for server computing performance and memory. They have long prediction times and low detection efficiency when classifying domain names, and cannot adapt to environments where DNS requests arrive at high speeds, resulting in poor real-time performance. The inventors discovered that, based on the characteristics of one-time domain names and the evaluation results of domain name features, a large number of name features for one-time domain names can be selected, and these features can effectively distinguish one-time domain names from non-one-time domain names. This alleviates the problem of misclassification caused by the limited number of name features used in existing methods. Furthermore, since the LSTM model has high requirements for server computing power and memory, resulting in long prediction times and low detection efficiency in domain name classification, the inventors propose a scheme using a random forest model with low computational overhead and high detection efficiency for domain name classification to alleviate the problems of long prediction times and low detection efficiency. Therefore, this invention proposes a classification model construction method for domain name classification based on the above research, and a domain name classification system based on this method.

[0032] To better understand the present invention, the present invention will be described in detail below with reference to the accompanying drawings and embodiments.

[0033] According to an embodiment of the present invention, a method for constructing a classification model for domain name classification is provided. The classification model is a random forest model, and the random forest model includes multiple decision tree classifiers. In summary, as follows... Figure 1 As shown, it includes: S1, obtaining DNS response data from the DNS server and preprocessing it to obtain a training set with domain name type labels; S2, performing various feature extractions on the training set obtained in step S1 to obtain the feature set corresponding to each domain name sample in the training set; S3, based on the training set after feature extraction in step S2, constructing a random forest model with the feature set corresponding to the domain name sample as input and the domain name sample type as output.

[0034] To better understand this invention, a detailed explanation is provided from the perspectives of data acquisition and preprocessing, domain name feature extraction, and random forest model construction.

[0035] I. Data Acquisition and Preprocessing Stage

[0036] 1.1 Data Acquisition: Acquire DNS response data from the DNS server.

[0037] 1.2 Data Preprocessing: The acquired DNS response data is preprocessed to obtain a training set with domain type labels. This preprocessing includes extracting data from the DNS response data to obtain the initial training set, and labeling the domain samples in the initial training set with domain type labels to obtain the training set with domain type labels. The data preprocessing process is described in detail below.

[0038] 1.21. Extract data from DNS response data to obtain an initial training set.

[0039] The process of extracting DNS response data includes extracting DNS response data with query types of A records, AAAA records, and status codes indicating no errors. Specifically, DNS response data with query types of A records and AAAA records is extracted first from the DNS response data. According to an example of the present invention, eight days of DNS response data are selected from a large public DNS recursive server. This response data covers DNS response data from December 24, 2020 to December 31, 2020. The response data is then filtered for A records and AAAA records, and the filtering results are shown in Table 1. The percentages of different resource records in the DNS response data are as follows: A records account for 73.56%, AAAA records account for 16.35%, HTTPS records account for 6.04%, PTR records account for 3.35%, ANY records account for 0.30%, SRV records account for 0.11%, TXT records account for 0.10%, NS records account for 0.07%, SOA records account for 0.01%, and other records account for 0.01%.

[0040] Table 1. Percentage of Resource Record Types

[0041]

[0042] After filtering out the DNS response data for A records and AAAA records, DNS response data with error-free status codes is extracted, and multiple DNS request domains are randomly selected from these to form an initial training set. According to an example of the present invention, taking the example of selecting 8 days of DNS response data from the DNS recursive server as described above, after filtering out the DNS response data corresponding to A records and AAAA records, DNS response data with error-free status codes is extracted, and the extraction results are shown in Table 2. Approximately 270 million DNS response data entries were recorded during the 8 days from December 24, 2020 to December 31, 2020, with each day's DNS response data ranging from approximately 5.8 to 21.1 GB. The DNS response data includes approximately 2.66 million DNS request domains; approximately 1.58 million are duplicate DNS request domains, accounting for 59.3% of all DNS request domains; and approximately 1.08 million are unique DNS request domains, accounting for 40.7% of all DNS domain request domains. It should be noted that one DNS response record corresponds to one DNS request domain name. However, a domain name may be requested repeatedly. Therefore, multiple DNS response records may correspond to the same domain name. In this case, the number of DNS response records is not exactly the same as the number of DNS request domain names. Since the acquired data is in the hundreds of millions, directly using this data as the initial training set would consume a significant amount of time during further processing. Therefore, to save processing time, this invention randomly selects a portion of the data to form the initial training set. According to an example of this invention, still using the 270 million DNS response records obtained in the previous example, 3.0% of the DNS request domain names are randomly selected as samples to form the initial training set.

[0043] Table 2 DNS Response Data Details

[0044]

[0045]

[0046] 1.22. Label the domain name samples in the initial training set with domain name type tags to obtain a training set with domain name type tags. According to one embodiment of the present invention, the domain name type tags include one-time domain name tags or non-one-time domain name type tags. Specifically, the process of labeling the initial training set with domain name type tags includes: dividing the initial training set into multiple one-time regions according to preset rules, then labeling the domain name samples in the initial training set that belong to any one of the one-time regions with one-time domain name tags, and labeling the remaining domain name samples that do not belong to any one-time region with non-one-time domain name tags.

[0047] According to one embodiment of the present invention, the preset rule is:

[0048] First, the domain name samples in the initial training set are divided into different regions based on the second-level domain name. Each region corresponds to one second-level domain name, and all domain names within a region include the second-level domain name corresponding to that region. According to an example of the present invention, when the second-level domain name corresponding to a region is gaolileo.baiduyundns.com, this region includes domain name samples such as xxx.gaolileo.baiduyundns.com, xxx.xxx.gaolileo.baiduyundns.com, and xxx.xxx.xxx.gaolileo.baiduyundns.com. That is, this region includes all domain name samples containing the suffix gaolileo.baiduyundns.com (this region includes all subdomains of gaolileo.baiduyundns.com), but this region does not include the second-level domain name gaolileo.baiduyundns.com itself. The domain name samples included in regions corresponding to other second-level domain names are similar and will not be elaborated further here. It should be noted that the reason for using second-level domains as the standard for dividing regions is that if first-level domains were used as the standard to divide the domain samples in the initial training set into different regions, the domain samples included in different regions would be too complex. Moreover, after manual verification of all regions, it was found that judging whether all regions are one-time regions according to the threshold conditions corresponding to the one-time region identification features is prone to misjudgment, thus affecting the accuracy of data labeling. If third-level, fourth-level, or even lower-level domains were used as the standard to divide the domain samples in the initial training set into different regions, the number of domain samples included in different regions would be reduced. Furthermore, after manual verification of all regions, it was found that judging whether all regions are one-time regions according to the threshold conditions corresponding to the one-time region identification features would miss some one-time regions, thus affecting the accuracy of data labeling.

[0049] Then, based on the threshold conditions corresponding to the one-time region identification feature, it is determined whether the second-level domain name corresponding to each region is a one-time region identifier. The second-level domain name that satisfies all the threshold conditions corresponding to the one-time region identification feature is a one-time region identifier, and the region whose corresponding second-level domain name is a one-time region identifier is regarded as a one-time region. According to an embodiment of the present invention, the one-time region identification feature includes a first identification feature, a second identification feature, a third identification feature, a fourth identification feature, a fifth identification feature, and a sixth identification feature, wherein, the first identification feature is the number of subdomains contained in the region; the second identification feature is the percentage of subdomains in the region with a cache hit rate of 0; the third identification feature is the percentage of subdomains in the region with a probability of being accessed again within the time to live (TTL) of 0; the fourth identification feature is the percentage of subdomains in the region with fewer than 5 accesses; the fifth identification feature is the average Shannon entropy of the leftmost segment of all subdomain strings contained in the region; and the sixth identification feature is the variance of the Shannon entropy of the leftmost segment of all subdomain strings contained in the region. It should be noted that the one-time region identification feature can be set according to actual needs. Any feature capable of accurately distinguishing one-time domain names from non-one-time domain names is acceptable, and this invention does not impose any special limitations. According to one embodiment of the invention, the threshold condition corresponding to the first identification feature is a first identification feature value greater than or equal to 20; the threshold condition corresponding to the second identification feature is a second identification feature value greater than or equal to 50%; the threshold condition corresponding to the third identification feature is a third identification feature value greater than or equal to 60%; the threshold condition corresponding to the fourth identification feature is a fourth identification feature value greater than or equal to 50%; the threshold condition corresponding to the fifth identification feature is a fifth identification feature value greater than or equal to 3; and the threshold condition corresponding to the sixth identification feature is a sixth identification feature value less than or equal to 1. It should be noted that the threshold condition corresponding to the one-time region identification feature can be set according to actual needs. Any feature capable of determining whether the second-level domain name corresponding to the region is a one-time region identifier is acceptable, and this invention does not impose any special limitations. It should be noted that the reason for defining one-time regions is that one-time domain names often belong to a one-time region. Therefore, one-time domain names can be quickly found and tagged by defining one-time regions.

[0050] To better understand the process of labeling the initial training set with domain name types, let's take the example of randomly selecting 3% of DNS request domain names from 270 million records as samples to form the initial training set. The process is as follows: The domain name samples in the initial training set are divided into different regions based on second-level domains. Each region's corresponding second-level domain is judged according to the threshold conditions corresponding to the one-time region identification feature to determine whether it is a one-time region identifier. Second-level domains that meet all the threshold conditions corresponding to the one-time region identification feature are one-time region identifiers. Regions with one-time region identifiers are designated as one-time regions, resulting in 66 one-time regions. Then, domain name samples belonging to any one of these 66 one-time regions are labeled with a one-time domain name tag, while the remaining domain name samples are labeled with a non-one-time domain name tag. The labeling results are shown in Table 3. Label 0 indicates approximately 7.9 million non-one-time domain names, while label 1 indicates approximately 82,000 one-time domain names. It should be noted that to ensure the accuracy of the domain name type labeling, a secondary manual screening of domain name samples within one-time regions can be performed based on the number of queries for a single domain name sample.

[0051] Table 3. Labeling results of the initial training set

[0052] Label Data volume 0 (Non-one-time domain name) 7896180 1 (One-time domain name) 81824

[0053] II. Domain Feature Extraction Stage

[0054] After obtaining the training set with domain type labels, it is necessary to extract domain features from the training set. To better understand this invention, before introducing how to extract domain features from the training set with domain type labels, we will first explain how to select appropriate features to distinguish between one-time domains and non-one-time domains (feature extraction is performed on the training set with domain type labels based on these selected features). The process of selecting features will be explained in detail below.

[0055] Because one-time domain names are domain names used in normal network activities, they receive normal responses and are stored in DNS recursive servers. Furthermore, one-time domain names are queried less frequently because they are mostly automatically generated by network services for a specific purpose; therefore, they are queried only once or very infrequently. Aside from the number of queries, there are no particularly obvious distinguishing features between one-time and non-one-time domain names. To accurately distinguish between one-time and non-one-time domain names, the inventors discovered the following characteristics of one-time domain names: 1. One-time domain names are generally longer. They are typically used to convey specific information and often carry more content, thus making them longer than non-one-time domain names. 2. The longest subdomain of a one-time domain name is longer. Similar to the first point, one-time domain names usually place the main information in the leftmost subdomain, resulting in a longer longest subdomain. 3. One-time domain names often do not contain obvious semantic information. Although they are long and contain a lot of information, they are usually automatically generated rather than composed of meaningful words, so they do not contain obvious semantic information. 4. One-time domain names contain a large number of numbers. Because numbers are relatively difficult to remember, non-one-time domains, except for some special websites, often do not contain many numbers. One-time domains, however, contain a higher proportion of numbers due to the inclusion of numerical hashes, version numbers, and other information. 5. One-time domains have a large number of separators. One-time domains often use "·" and "-" to format the information carried in the domain, thus one-time domains often have a longer depth (more subdomains) compared to non-one-time domains. 6. One-time zones often contain a large number of domains, and these domains are often one-time domains. 7. The domain structures within one-time domain zones are similar. It should be noted that the above seven characteristics of one-time domains are analyzed for individual domains, not for the entire one-time domain zone, and do not include posterior knowledge such as query counts and cache hit rates.

[0056] Furthermore, based on the characteristics of one-time domain names discovered in the above research, the inventors proposed to classify one-time domain names and non-one-time domain names using the features shown in Table 4. The first feature is the domain name string length; the second feature is the longest subdomain length, which is the length of the longest string separated by "·" in the domain name; the third feature is the domain name format field sum, which is the sum of the number of segments separated by "·" and the number of segments separated by "-" in the domain name; the fourth feature is the number of special length fields in the domain name, which is the sum of the number of segments with a string length of less than or equal to 3 separated by "·" and the number of segments with a string length of greater than or equal to 10 separated by "-" in the domain name; the fifth feature is the Shannon entropy of the leftmost segment of the domain name (Shannon entropy is a conventional technical method and will not be elaborated here); the sixth feature is the percentage of numbers in the leftmost segment of the domain name, which refers to the percentage of numbers in the leftmost string separated by "·" in the domain name; and the seventh feature is the ratio of the number of meaningful words in the leftmost segment of the domain name, which refers to the ratio of the length of the leftmost string separated by "·" to the number of meaningful words, i.e., the length of the leftmost segment / the number of meaningful words. It should be noted that features one through five are common domain name features; features six and seven are newly introduced domain name features in this invention. The reason for considering features six and seven is that strings of the same length made up of words versus random characters make a significant difference, and Shannon entropy cannot fully express the degree of string disorder; multiple words with different letters may also be considered strings with high Shannon entropy. Therefore, this invention, based on the ratio of numerical proportions and the ratio of meaningful words, further strengthens the identification of one-time domain names from the perspective of domain name semantics and content, avoiding misjudgments. Furthermore, the reason for choosing the ratio of meaningful words rather than the percentage of meaningful words is that some abbreviations, such as FLV (Flash Video, a streaming media format) and RTMP (Real Time Messaging Protocol), are classified as meaningless words in some word checks, but these words generally do not appear multiple times in the field. In this case, simply looking at the percentage of meaningful words in the leftmost segment of the string would lead to many misjudgments, while using the length of the leftmost segment of the string divided by the number of meaningful words can reduce misjudgments. In other words, when a word is too long, it is very likely that the word is not a normal word.

[0057] Table 4 Domain Name Feature Details

[0058]

[0059]

[0060] To demonstrate that the seven features mentioned above can effectively distinguish between one-time and non-one-time domain names, we will again use the labeled training set obtained in the previous example, which includes 7.9 million non-one-time domain names and 82,000 one-time domain names. We will evaluate the features of this training set according to the first, second, third, fourth, fifth, sixth, and seventh features, and obtain the following results: Figures 2-8 The feature evaluation graphs all include two curves: one representing one-time domain names and the other representing non-one-time domain names. The ordinate of all feature evaluation graphs is the cumulative distribution function (CDF), which represents the sum of events occurring to the left of point x (the horizontal axis). Figure 2 The first feature evaluation graph shows that the horizontal axis represents the domain name length. As can be seen from the graph, when the domain name length is less than or equal to 40, the probability that a domain name is a non-one-time domain name is 99%, and the probability that a domain name is a one-time domain name is 40%. Therefore, it can be seen that as long as an appropriate domain name length threshold is set, one-time domain names and non-one-time domain names can be distinguished relatively accurately. Figure 3 The second feature evaluation graph shows that the horizontal axis represents the length of the longest subdomain in the domain name. As can be seen from the graph, when the length of the longest subdomain is 20, the probability that a domain name is a non-one-time domain name is 99%, and the probability that a domain name is a one-time domain name is 38%. Therefore, it can be seen that as long as an appropriate threshold for the length of the longest subdomain is set, one-time domain names and non-one-time domain names can be distinguished relatively accurately. Figure 4 The third feature evaluation graph shows that the horizontal axis represents the domain name format field sum. As can be seen from the graph, when the domain name format field sum is 9, the probability that a domain name is a non-one-time domain name is 99%, and the probability that a domain name is a one-time domain name is 42%. Therefore, it can be seen that as long as an appropriate threshold for the domain name format field sum is set, one-time domain names and non-one-time domain names can be distinguished relatively accurately. Figure 5 The fourth feature evaluation graph shows that the horizontal axis represents the number of special length fields in the domain name. As can be seen from the graph, when the number of special length fields in the domain name is 3, the probability that a domain name is a non-one-time domain name is 84%, and the probability that a domain name is a one-time domain name is 40%. Therefore, it can be seen that as long as an appropriate threshold for the number of special length fields in the domain name is set, one-time domain names and non-one-time domain names can be distinguished relatively accurately. Figure 6 The fifth feature evaluation graph shows that the horizontal axis represents the Shannon entropy of the leftmost segment of the domain name. As can be seen from the graph, when the Shannon entropy of the leftmost segment of the domain name is 3.2, the probability that a domain name is a non-one-time domain name is 95%, and the probability that a domain name is a one-time domain name is 40%. Therefore, it can be seen that as long as an appropriate threshold for the Shannon entropy of the leftmost segment of the domain name is set, one-time domain names and non-one-time domain names can be distinguished relatively accurately. Figure 7The sixth feature evaluation chart shows that the horizontal axis of the chart represents the percentage of the leftmost number in the domain name. As can be seen from the chart, when the percentage of the leftmost number in the domain name is 60%, the probability that a domain name is a non-one-time domain name is 97%, and the probability that a domain name is a one-time domain name is 30%. Therefore, it can be seen that as long as an appropriate threshold is set for the percentage of the leftmost number in the domain name, one-time domain names and non-one-time domain names can be distinguished relatively accurately. Figure 8 The seventh feature evaluation graph shows that the horizontal axis represents the ratio of meaningful words in the leftmost segment of a domain name. As the graph shows, when the ratio of meaningful words in the leftmost segment of a domain name is 8, the probability that a domain name is not a one-time domain name is 90%, and the probability that a domain name is a one-time domain name is 40%. Therefore, by setting an appropriate threshold for the ratio of meaningful words in the leftmost segment of a domain name, one-time domain names and non-one-time domain names can be distinguished relatively accurately. In summary, based on the above features and by reasonably setting their corresponding feature thresholds, one-time domain names and non-one-time domain names can be effectively distinguished.

[0061] After determining which features to use to distinguish between one-time domain names and non-one-time domain names, multiple features are extracted from the training set with domain name type labels based on these features to obtain the feature set corresponding to each domain name sample in the training set. The feature set includes feature values ​​corresponding to multiple features, including a first feature, a second feature, a third feature, a fourth feature, a fifth feature, a sixth feature, and / or a seventh feature.

[0062] III. Random Forest Model Construction Stage

[0063] In the construction of the random forest model, based on the training set with extracted features and domain name type labels, the model is constructed using the feature set corresponding to the domain name samples as input and the domain name sample type as output. According to one embodiment of the present invention, the random forest model includes 5 decision tree classifiers, and the depth of each decision tree classifier is 5.

[0064] According to one embodiment of the present invention, in the construction stage of the random forest model, 75% of the domain name samples with domain name type labels after feature extraction are selected from the training set to construct the random forest model, and the remaining domain name samples are used to test the constructed random forest model.

[0065] According to one embodiment of the present invention, when constructing the random forest model, it is necessary to set weight values ​​corresponding to the various features, wherein the weight value corresponding to each feature is determined experimentally. According to an example of the present invention, such as... Figure 9As shown, the diagram displays the weight values ​​corresponding to each feature. F1 represents the first feature with a weight of 24%; F2 represents the second feature with a weight of 21.8%; F3 represents the third feature with a weight of 8.6%; F4 represents the fourth feature with a weight of 6.9%; F5 represents the fifth feature with a weight of 7.6%; F6 represents the sixth feature with a weight of 15.2%; and F7 represents the seventh feature with a weight of 15.9%. It should be noted that feature weights represent the probability of that feature appearing in each node of the random forest model. A higher feature weight indicates a higher probability of that feature appearing in each node of the random forest model, and also indicates that that feature is more important than other features. Feature weights can be adjusted according to actual needs. The set feature weight values ​​only need to ensure that the accuracy of the final constructed random forest model meets the preset requirements or achieves the highest possible accuracy. This invention does not impose specific limitations.

[0066] According to one embodiment of the present invention, grid parameters and five-fold cross-validation are used to verify the accuracy of the random forest model during the construction process.

[0067] According to one embodiment of the present invention, the constructed random forest model is evaluated according to four metrics during the construction process: precision, recall, T1 score, and accuracy. Precision reflects the proportion of true positives among the domain name samples predicted as positive (one-time domain names); recall reflects the proportion of true positives predicted as positive; T1 score reflects the harmonic mean of precision and recall; and accuracy reflects the proportion of correct predictions made by the random forest model. It should be noted that when all four metrics of the random forest model meet the preset requirements, the random forest model is saved as the final model; when any one of the four metrics of the random forest model fails to meet the preset requirements, the weight values ​​corresponding to various features are readjusted, and the random forest model is reconstructed based on the training set with domain name type labels after feature extraction, with the feature set corresponding to the domain name sample as input and the domain name sample type as output. The random forest model is then validated by the metrics, and the above operations are repeated until the metrics of the random forest model reach the preset standard or the metrics reach the optimal level.

[0068] To verify that the constructed random forest model can effectively distinguish between one-time and non-one-time domain names, according to an example of the present invention, taking the labeled training set of 7.9 million non-one-time domain names and 82,000 one-time domain names obtained in the previous example as an example, feature extraction is performed on the training set to obtain the feature set corresponding to each domain name sample in the training set. Then, using the feature set corresponding to the domain name samples in the training set as input and the domain name sample type as output, a decision tree classifier and a random forest model are constructed respectively (feature weights are as follows). Figure 9 As shown in Table 5, the performance of the decision tree classifier and the random forest model were evaluated according to the four indicators in the aforementioned embodiments. The evaluation results are shown in Table 5. The precision of the decision tree classifier is 97%, the recall is 82%, the T1 score is 89%, and the accuracy is 99%. The precision of the random forest model is 98%, the recall is 87%, the T1 score is 93%, and the accuracy is 99%. Based on the evaluation results, it can be seen that the performance of the random forest model is better than that of a single decision tree classifier. At the same time, since the precision can reach 98%, it shows that the features selected by this invention can effectively distinguish between one-time domain names and non-one-time domain names.

[0069] Table 5. Evaluation Results of Indicators

[0070] Indicator Type Precision Recall rate T1 score accuracy Decision tree classifier 97％ 82％ 89％ 99％ Random Forest Model 98％ 87％ 93％ 99％

[0071] Based on the random forest model constructed in the foregoing embodiments, according to an embodiment of the present invention, such as... Figure 10 As shown, a classification system for domain name classification is provided. The system includes: a data acquisition module for acquiring data to be processed; a feature extraction module for extracting features from the data to be processed obtained by the data acquisition module to obtain its corresponding feature set; and a classification model trained based on the foregoing embodiments for classifying the data to be processed based on the feature set obtained by the feature extraction module.

[0072] The beneficial effects of this invention are as follows: selecting seven features to distinguish between one-time domain names and non-one-time domain names can alleviate the problem in existing methods that cannot distinguish between one-time and non-one-time domain names due to the limited number of name features used, making domain name classification based on domain name features more accurate and reducing misjudgments; using a random forest model composed of multiple decision tree classifiers for domain name classification can alleviate the problems of long prediction time and low detection efficiency in existing methods, and further, can effectively improve the hit rate of DNS server cache, thereby accelerating the user's query speed.

[0073] It should be noted that although the steps are described in a specific order above, it does not mean that the steps must be executed in the above specific order. In fact, some of these steps can be executed concurrently or even in a different order, as long as the required function can be achieved.

[0074] This invention can be a system, method, and / or computer program product. A computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for causing a processor to implement various aspects of the invention.

[0075] Computer-readable storage media can be tangible devices that hold and store instructions for use by an instruction execution device. Computer-readable storage media can be, for example, including but not limited to, electrical storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital multifunction disc (DVD), memory sticks, floppy disks, mechanical encoding devices, such as punch cards or recessed protrusions storing instructions thereon, and any suitable combination thereof.

[0076] The various embodiments of the present invention have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or technical improvements to the embodiments in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A method for constructing a classification model for domain name classification, wherein the classification model is a random forest model, and the random forest model includes multiple decision tree classifiers, characterized in that, The method includes the following steps: S1. Obtain DNS response data from the DNS server and preprocess it to obtain a training set with domain name type labels, wherein the domain name type labels are one-time domain name labels or non-one-time domain name labels. In step S1, DNS response data within a preset time period is obtained from the DNS server and preprocessed according to the following steps to obtain a training set with domain name type labels: S11. Extract DNS response data with query type A record and AAAA record from the DNS response data; S12. Extract DNS response data with status codes indicating no errors from the DNS response data obtained after processing in step S11, and randomly select multiple DNS request domain names from them as samples to form an initial training set. S13. Add domain type labels to the domain name samples in the initial training set obtained in step S12 to obtain a training set with domain type labels. Step S13 includes: S131. Divide the initial training set obtained in step S12 into multiple one-time regions according to the preset rules; S132. Label the domain name samples in the initial training set that belong to any of the one-time regions with one-time domain name tags, and label the remaining domain name samples that do not belong to any one-time region with non-one-time domain name tags; S2. Perform multiple feature extractions on the training set obtained in step S1 to obtain a feature set corresponding to each domain name sample in the training set. The feature set includes feature values ​​corresponding to multiple features. The multiple features include a first feature, a second feature, a third feature, a fourth feature, a fifth feature, a sixth feature, and / or a seventh feature. The first feature is the length of the domain name string; the second feature is the length of the longest subdomain of the domain name; the third feature is the sum of the domain name format fields; the fourth feature is the number of special length fields in the domain name; the fifth feature is the Shannon entropy of the leftmost segment of the domain name; the sixth feature is the percentage of numbers in the leftmost segment of the domain name; and the seventh feature is the ratio of the number of meaningful words in the leftmost segment of the domain name. S3. Based on the training set after feature extraction in step S2, construct a random forest model with the feature set corresponding to the domain name sample as input and the domain name sample type as output.

2. The method according to claim 1, characterized in that, In step S131, the preset rule is: The domain name samples in the initial training set are divided into different regions based on the second-level domain name. Each region corresponds to a second-level domain name, and all domain names in a region include the second-level domain name corresponding to that region. Based on the threshold conditions corresponding to the one-time region identification features, determine whether the second-level domain name corresponding to each region is a one-time region identifier. The second-level domain name that meets all the threshold conditions corresponding to the one-time region identification features is a one-time region identifier, and the region whose corresponding second-level domain name is a one-time region identifier is regarded as a one-time region.

3. The method according to claim 2, characterized in that, The one-time region identification features include a first identification feature, a second identification feature, a third identification feature, a fourth identification feature, a fifth identification feature, and a sixth identification feature. The first identification feature is the number of subdomains contained in the region; the second identification feature is the percentage of subdomains in the region with a cache hit rate of 0; the third identification feature is the percentage of subdomains in the region with a probability of being accessed again within their lifetime of 0; the fourth identification feature is the percentage of subdomains in the region with fewer than 5 accesses; the fifth identification feature is the average Shannon entropy of the leftmost segment of all subdomain strings contained in the region; and the sixth identification feature is the variance of the Shannon entropy of the leftmost segment of all subdomain strings contained in the region.

4. The method according to claim 3, characterized in that, The threshold condition corresponding to the first identification feature is that the value of the first identification feature is greater than or equal to 20; the threshold condition corresponding to the second identification feature is that the value of the second identification feature is greater than or equal to 50%; the threshold condition corresponding to the third identification feature is that the value of the third identification feature is greater than or equal to 60%; the threshold condition corresponding to the fourth identification feature is that the value of the fourth identification feature is greater than or equal to 50%; the threshold condition corresponding to the fifth identification feature is that the value of the fifth identification feature is greater than or equal to 3; and the threshold condition corresponding to the sixth identification feature is that the value of the sixth identification feature is less than or equal to 1.

5. The method according to claim 4, characterized in that, In step S3, when constructing the random forest model, it is necessary to set the weight values ​​corresponding to the various features, wherein the weight value corresponding to each feature is determined experimentally.

6. The method according to claim 5, characterized in that, The random forest model includes 5 decision tree classifiers, and the depth of the decision tree classifiers is 5.

7. A classification system for domain name classification, characterized in that, The system includes: The data acquisition module is used to acquire the data to be processed. The feature extraction module is used to extract features from the data to be processed obtained by the data acquisition module to obtain its corresponding feature set. The classification model constructed by any one of the methods described in claims 1-6 is used to classify the data to be processed based on the feature set obtained by the feature extraction module.

8. A domain name processing method applied to a DNS server, characterized in that, The method includes the following steps: T1. Obtain the domain name data to be processed; T2. The domain name data to be processed obtained in step T1 is classified using the classification system as described in claim 7 to obtain its classification result; T3. Based on the classification results obtained in step T2, discard the domain name data to be processed that are classified as one-time domain names, and store the domain name data to be processed that are classified as non-one-time domain names in the cache space of the DNS server.

9. A computer-readable storage medium, characterized in that, It stores a computer program that can be executed by a processor to implement the steps of the method according to any one of claims 1-6, 8.

10. An electronic device, characterized in that, include: One or more processors; A storage device for storing one or more programs, which, when executed by one or more processors, cause the electronic device to perform the steps of the method as described in any one of claims 1-6, 8.

Images